CVE-2026-56450 Details
Description
AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable brute-force guessing of a valid code and bypass the intended second authentication factor, resulting in unauthorized account access. The patch introduces per-user failed-OTP tracking, blocks verification after 30 failed attempts for one hour, clears the counter after a successful OTP verification, and provides administrator recovery actions to purge affected lockouts.
A vulnerability in AIL's two-factor authentication (2FA) process allows for unlimited repeated attempts to guess one-time password (OTP) codes. This issue arises because the application does not limit failed OTP verification attempts. An attacker who has successfully logged in and reached the 2FA verification stage could brute-force OTP codes, bypassing the second authentication factor and gaining unauthorized access to the account. The vulnerability affects AIL versions prior to the patch introduced in June 2026.
AIL has implemented a patch that tracks failed OTP attempts per user, blocks verification after 30 failed attempts for one hour, and clears the counter after a successful OTP verification. Additionally, administrators can purge affected lockouts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ail-project/ail-framework/commit/d3a394fe68fd5aeee86f3a3c91d4a0350f91e974 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| AIL | All versions |
CPE
Remediation | |
| AIL Framework | All versions |
CPE
Remediation | |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | CIRCL |